CVE-2016-6893
Estado: ModificadaAlta (8.8)—
Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Puntuación base: 8.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.61%
- Percentil entre todas las CVEs puntuadas: 75
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-352
Referencias
- http://www.debian.org/security/2016/dsa-3668
- http://www.securityfocus.com/bid/92731
- http://www.securitytracker.com/id/1036728
- https://bugs.launchpad.net/bugs/1614841
- http://www.debian.org/security/2016/dsa-3668
- http://www.securityfocus.com/bid/92731
- http://www.securitytracker.com/id/1036728
- https://bugs.launchpad.net/bugs/1614841
JSON original (NVD)
Mostrar
{
"id": "CVE-2016-6893",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.8,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2016-09-02T14:59:09.283",
"references": [
{
"url": "http://www.debian.org/security/2016/dsa-3668",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/92731",
"source": "cve@mitre.org"
},
{
"url": "http://www.securitytracker.com/id/1036728",
"source": "cve@mitre.org"
},
{
"url": "https://bugs.launchpad.net/bugs/1614841",
"tags": [
"Issue Tracking"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.debian.org/security/2016/dsa-3668",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/92731",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id/1036728",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugs.launchpad.net/bugs/1614841",
"tags": [
"Issue Tracking"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account."
},
{
"lang": "es",
"value": "Vulnerabilidad de CSRF en la página de opciones de usuario en GNU Mailman 2.1.x en versiones anteriores a 2.1.23 permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios para peticiones que modifican una opción, tal como se demuestra ganando acceso a las credenciales de una cuenta de una víctima."
}
],
"lastModified": "2026-06-17T00:51:56.937",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B1D6A976-FFEA-4DB6-B002-8036E778C78E"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8894855-E303-4B55-B3BC-DCBE3A0AB703"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0B1500D8-952A-46C6-920C-096760C36A43"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "503D7346-4891-40B1-A0CD-0FACC5359431"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "643610C6-99A9-43C9-A8FC-463A244C08DE"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "45C53260-503F-4934-B1FE-9FACD8E0EE66"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A34CBFC5-CB18-4FE4-9B4D-F3280CBCCD6C"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E2571330-3239-469E-883D-8994257D0C55"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5F27323B-6B10-4941-B20B-187562797D44"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "890FEDE2-474A-4870-9165-CAD39BC6D318"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.10:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D4FFE8F2-B665-41F1-B4C5-E7C66BE91E24"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.10b1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8C08F313-30E9-4B9E-BA5A-4910DD5E155C"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.10b3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D9B09DFC-A238-49CA-9DB8-F4052775BF3D"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.10b4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C219D531-3E3A-4B85-B3A6-8A4335E86AB7"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A1C7EEDB-5794-419A-8E61-137DB76A4E15"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.11:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C1FC55D7-3857-4614-82FC-5266A3BD8FE8"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.11:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A64FECFD-F6BF-49C1-926C-41868787378C"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.12:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5F7A3B58-4038-41AE-A42E-BE743A14D5A2"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.12:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2C3215CB-7146-49D3-B350-A07E0C9FB04D"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.12:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "800F3CE3-CEE2-4C63-B0DD-F9F72E9F1B71"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2019E834-DFF4-4C9A-82D1-E768EA8934EF"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.13:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E3D1CC02-7D5F-41CB-A881-A82A13CE9EE5"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "11010D5F-AA02-45EC-B007-47BF9194250B"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.14:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A677EC3D-A08A-44B8-B7E1-F229F515F407"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.14-1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "876E65AB-6D2E-41C2-899E-7D5EE176F877"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.15:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7985A5B3-0473-426D-9F8D-63B81C7D1177"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.15:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B211D97-5316-4EB1-999D-26C53708F200"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.16:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F6AC4D1E-B92F-400A-8B73-CB99E5825A05"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.16:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5BB702F4-324D-4B87-9590-22CD2465A708"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.16:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "47B47F16-4E68-4DB2-9C61-DBABB75C7A99"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.16:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "11931F41-6B65-4C1B-9A82-8F89F093E9AA"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "59A972C3-06C4-4DED-825C-B1931B35E135"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.18:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6BB3C5C8-98AC-4BC3-A06E-6F2920CA951B"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.18:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1C3BC472-4428-4786-A3AA-390C66553DC0"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.18:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "69B95EB8-6D8B-4342-A6A8-472BF1190A87"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.18:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "011CD4BF-FE51-40A7-B457-884DDF3C7FFC"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.18-1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9C2DA8DD-77C1-44A0-9A49-FB1CEE26CB1E"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.19:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "68C51AFA-3C45-48A2-8ADC-514BF5374413"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.19:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BF11D5FD-FCD5-4147-876C-09980D05152C"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.19:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "503671C5-1F2A-4676-8D58-86C2D01405E5"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.19:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5154BCB6-2216-433E-BC77-B862490545F4"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.20:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E73970DC-7F70-437E-A669-B0EE6F4629AF"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.21:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "13081A16-D625-4AD1-9493-AFA5126269C6"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.21:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F6F40EE5-9E50-4703-9151-4640B11C78A6"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51028759-33CD-4C80-A534-B46E62C03F4D"
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.23:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "683F421B-C986-4572-9612-1635AF7DD084"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}